Latest Articles

Change Mouse Pointer Speed
Disable Data Execution Prevention
Single Click Instead of Double Click
Automatic Vista Backups
Select Multiple Files with Checkboxes
Delete Temporary Files
Repair Corrupt Vista Files
Hide Hard Drive
Change Background Image
Clear DNS Cache



Sections

Home Page
Vista Tips
Vista Forums
File Database
Contact Us
Links
Archive
RSS Feed

Files beginning with r

The table below includes any files beginning with r, from which further information can be found by clicking on the process title. The icon beside the information can be used to quickly determine if this is a safe file in combination with the key below:
This file is normally safe to leave running. In most cases, this file is not required to run on startup and can be run manually. Warning, this file may be a virus, spyware, resource hog and running it is not recommended. This file may or may not be necessary to load on startup, depending on your circumstances. No information is available for this item.

[#] [A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W] [X] [Y] [Z]

Files beginning with r:

File Type File Name Process Name and Information
rundll32.exe [path] Zykheptd.dll (default)
Added by the HESIVE.B TROJAN!
rchost.exe .norton
Added by the BOXED-H TROJAN!
rundll32.exe shell32.dll, Control_RunDLL ...123456.cpl 123456
Added by the KITRO.C (or DANDI.A) WORM! 123456 can be any random 3 to 6 digit number
rundll32.exe D0CE0C16B1, D0CE0C16B1 98D0CE0C16B1
BrowserAid/BrowserPal foistware
regedit -s ..win.dll @
Added by the SEEKER.K TROJAN!
reminder.exe @loha
Registration reminder for @loha@home E-mail utility
Reminder.exe Acer Tour Reminder
Popup reminder to take the tour of your new Acer laptop
RunDll32.exe [path] Blocker.dll, Run Acronis Popup Blocker
Part of Acronis Privacy Expert - anti-spyware and security suite
READER~1.EXE Adobe Acrobat
Speeds up the time it takes to load the Adobe Reader application. Your choice, but not required for Adobe Reader to function properly
reader_sl.exe Adobe Reader Speed Lauch
Speeds up the launch of Adobe (Acrobat) Reader 7
reader_sl.exe Adobe Reader Speed Launch
Speeds up the time it takes to load the Adobe Reader application. Your choice, but not required for Adobe Reader to function properly
READER~1.EXE Adobe Reader Speed Launch
Speeds up the time it takes to load the Adobe Reader application. Your choice, but not required for Adobe Reader to function properly
rundll32.exe stmctrl.dll, TaskBar AdslTaskBar
ISP software, initializes DSL modem
Remupd.exe Agente
Part of Panda Antivirus . Is this an update reminder (guess because of the name), virus definition update reminder or something similar?
rundll32 amecsa.cpl, RUN_DLL AME_CSA
Loads ADSL modem Control Panel applet
regsvr32.exe ctasio.dll AsioReg
ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality
rregsvr32.exe ctasio.dll AsioThk32Reg
ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality
rundll32.exe [path] ASK.dll rdl ASK
Stealth Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!
reaIplayer.exe atidriver
Added by the WARPIGS-E WORM! Note the uppercase "I" in the filename, rather than a lower case "L"
RunDll32 AudCtrl.dll, RCMonitor AudCtrl
Audio control panel?
RUNDLL32 AUNPS2.DLL, _Run@16 AUNPS2
AUNPS adware
rundll32.exe [path] ToolbarATL.dll, LoadTrayIcon Authentic-ID Toolbar
Authentic-ID Toolbar - website authentication utility. Warns you when a site is recognized for phishing or isn't authentic, for example
REGPROP.EXE WMPADDIN.DLL AUTOPROP
Both the files are in the MS Office/Bots/FP_WMP directory. Apparently, it registers the FrontPage WiMP extension
rundll32 [path] DATADX.DLL, SHStart autoupdate
Added by a variant of the QOOLOGIC TROJAN!
rundll32 [path] SUPDATE.DLL, SHStart autoupdate
Added by a variant of the QOOLOGIC TROJAN!
rund1132.exe Avptask
Added by the AGENT.PKZ TROJAN!
Rundll32 AXFILTER.DLL, Rundll32 AxFilter
??
remin.exe B.Reader
Birthday Reminder 5.0 - as the name implies
rundll32 cnbabe.dll, dllstartup babeie
CommonName Toolbar spyware. To uninstall see here
rundll32.exe Background Intelligent Transfer Service
Added by the VB-ZD TROJAN! Note - this file is located in the C:Windowshelp folder, and is not to be confused with the legitimate rundll32.exe file!
rundll32.exe BatInfEx
Displays battery status information on an IBM Thinkpad
rundll32.exe bcmhal9x.dll, bcinit BCMHal
BlasterControl for Creative video cards - controls for desktop settings, monitor configuration, colour adjustments and performance tuning. May be needed to retain settings
Rundll32.exe BDSrHook.dll, Rundll32 BIE
BDplugin parasite
rundll32 [path] BatLogEx.DLL, StartBattLog BLOG
IBM Thinkpad battery management utility that logs changes in battery conditions such as charging, discharging, etc
RunDLL32.exe irprops.cpl, BluetoothAuthenticationAgent BlueToothAuthentication Agent
Associated with BlueTooth software, designed to allow bluetooth mobile devices to authenticate to the computer, when connecting a PDA to your computer - necessary for the computer and the PDA to communicate. Should you get the error message, "Rundll irprops.cpl missing entry Bluetooth authentication agent", click here for more information. In case you no longer have BlueTooth support installed, and don't need it, simply uncheck the entry in Msconfig > Startup
Rundll32 PWRMONIT.DLL, StartPwrMonitor BMMGAG
Displays a battery gauge icon in the Taskbar (not the System Tray). Provides shortcuts to IBM's proprietary power saving settings and to a battery information window
rundll32.exe [path] BatInfEx.dll, BMMAutonomicMonitor BMMMONWND
Battery power management utility for Lenovo (IBM) ThinkPad laptops
RunDLL32.EXE [path] bs2.dll, DllRun BookedSpace
BookedSpace parasite
rundll32.exe ...Bridge.dll Bridge
Flingstone.com browser hijacker
RakyatKelaparan.exe Bron-Spizaetus
Added by the BRONTOK-J or BRONTOK-L WORMS!
RunDLL32.EXE [path] bs3.dll, DllRun Bsx3
BookedSpace parasite
RCUI.exe BuzMe
Display Client for the BuzMe Internet Call Waiting Service
RunDLL32.EXE [path] bsx5.dll, DllRun bxsx5
BookedSpace parasite
RunDLL32.EXE [path] bxxs5.dll, dllrun bxxs5
BookedSpace parasite
REGCNT09.exe Card Monitor
For the USB connection on a Panasonic PV-DV701 Digital Camcorder. Available via Start -> Programs
regedit.exe Ccao
Probably a variant of MediaTickets adware. Note - this is not the valid Windows registry editor which resides in Windows or Winnt and will not figure in Msconfig/Startup! This version resides in a "mduu" subfolder, which may change
rundll32.exe streamci, StreamingDeviceSetup Ccdecode
Part of the closed caption decdoder/MS VBI codec. Should only run once
RunDLL32.EXE [path] cfgmgr51.dll, DllRun cfgmgr51
BookedSpace parasite
RunDLL32.EXE [path] cfgmgr52.dll, DllRun cfgmgr52
BookedSpace parasite
regload16.exe CheckScan32
Added by the AEBOT.K WORM!
runlli32.exe chope
Added by the QQPASS-U TROJAN!
run_21.exe Classes
Switch adult content dialler
rundll.exe setupx.dll, InstallHinfSection ..delwall.inf clnwall
??
Rundll32 cmicnfg.cpl, CMICtrlWnd Cmaudio
System tray control panel for C-Media based soundcards - often included on popular motherboards with in-built audio. Available via Start -> Settings -> Control Panel
RunDll32 CMICNFG3.CPL, CMICtrlWnd CmPCIaudio
Registers the Control Panel applet for a C-Media PCI sound card
Rundll32.exe CNSMIN.DLL, Rundll32 CnsMin
CnsMin (Chinese Keywords) hijacker related
rundll32.exe [path] AsTsVcc.dll, RegisterModule CognizanceTS
Cognizance Corp Identity And Access Management suite
ribiva.exe Comcast Network
Added by an IRC TROJAN variant!
Rundll32.exe SECURE32.CPL, Service Compaq Computer Security
??
regsvs.exe Compatibility Service Process
Added by the GAOBOT.YN WORM!
rundll32.exe MSA64CHK.dll, DllMostrar ContentDownload
MatrixDialer related
rundll32.exe ctrlpan.dll, Restore ControlPanel Control
CoolWebSearch Msconfd parasite variant
rundll32 internat.dll, LoadKeyboardProfile ControlPanel
CoolWebSearch parasite variant
rundll32.exe MSA64CHK.dll, DllMostrar CoolDownloads
MatrixDialer related
rundll32.exe MSA64CHK.dll, DllMostrar CoolMP3
MatrixDialer related
razerhid.exe Copperhead
Razer Copperhead mouse driver
Remind32.exe Corel Registration
If you don't want to register Corel products and be reminded about it every 2 weeks disable it
Remind32.exe Corel Registration Reminder
If you don't want to register Corel products and be reminded about it every 2 weeks disable it
rundll32.exe [path] cpu.dll,load CPU Watcher
Added by the DLOADER-LO TROJAN!
rundll32.exe CrazyTalk.dll, DIIServeMediaFile CrazyTalk Serve
CrazyTalk from Reallusion - "the worlds only facial animation tool that gives you the power to create talking animated images from a single photograph, complete with emotions." Can apparently be installed without your knowledge as well as being a legitimate download in it's own right from sites such as TUCOWS
rundll32.exe [path] drvmod.dll CTDrive
Added by a variant of the OP DIALER! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "drvmod.dll" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder
rundIl32.exe ctfnom
Added by the LEGMIR-AW TROJAN!
rundll32.exe [path] dabapi.dll, Rundll32 dabrun
SinaUpdateCenter adware
Regedit.exe ....data789.tmp Data789
Homepage hijacker
rundll32.exe DeadAIM.ocm, ExportedCheckODLs DeadAIM
DeadAIM - feature enhancing product for AOL's Instant Messenger program
rundll32.exe advpack.dll, DelNodeRunDLL32 submit.exe delsubmit
CoolWebSearch parasite variant
rundll32.exe msconfd.dll, Restore ControlPanel Desktop
Added by the BOOKMARKER TROJAN!
rundll32.exe MSA64CHK.dll, DllMostrar DesktopUpdate
MatrixDialer related
READREG DevconDefaultDB
Appears to be related to older Creative Soundblaster soundcards
Root.exe DevicePath
Added by the GRUEL WORM!
regsvr.exe DHCP Server
Added by the RBOT-PR WORM!
rundll32.exe msa32chk.dll Dialer
Unidentfied malware
Rnaap.exe DialUp Network Application
Added by a variant of the SDBOT WORM!
Recalculate.exe Diesel
Added by the LAZAR TROJAN!
regedit /s c:hpdjregfix.reg DJREGFIX
DJRegFix showed up first in WinME as a "clever" way to ensure that all Hewlett-Packard DeskJet printers actually worked with WinME - since most were having major problems. This "utility" adds the functionality and compatibility HP forgot to add in its WinME drivers
rundll32 [path] DLBTtime.dll, _RunDLLEntry@16 DLBTCATS
Resolves a timing problem where a Dell service tries to communicate with the printer but Windows is too busy - by either delaying the start of the service or restarting if the service failed to load. See here for more details on a similar Lexmark DLL entry (LXDCtime.dll)
rundll32 [path] DLBUtime.dll, _RunDLLEntry@16 DLBUCATS
Dell printer software - reports back on printer and cartridge useage
rundll32 [path] DLBXtime.dll, _RunDLLEntry@16 DLBXCATS
Resolves a timing problem where a Dell service tries to communicate with the printer but Windows is too busy - by either delaying the start of the service or restarting if the service failed to load. See here for more details on a similar Lexmark DLL entry (LXDCtime.dll)
rundll32 [path] DLCCtime.dll, _RunDLLEntry@16 DLCCCATS
Related to the Dell AIO A964 printer/scanner/copier which comes bundled with many Dell computers. Required for the Dell Ink Management System. If you use the 964 printer, Dell recommends leaving dlcctime.dll in place as it fixes compatibility issues on some Dell systems. If you receive an error message on system startup that reads: "Error in C:WINDOWSSystem32spooldriversW32x863DLCCtime.dll Missing entry: RunDLLEntry" Dell offers help here
rundll32 [path] DLCDtime.dll, _RunDLLEntry@16 DLCDCATS
Dell printer software - reports back on printer and cartridge useage
rundll32 [path] DLCFtime.dll, _RunDLLEntry@16 DLCFCATS
Dell printer software - reports back on printer and cartridge useage
rundll32 [path] DLCGtime.dll, _RunDLLEntry@16 DLCGCATS
Resolves a timing problem where a Dell service tries to communicate with the printer but Windows is too busy - by either delaying the start of the service or restarting if the service failed to load. See here for more details on a similar Lexmark DLL entry (LXDCtime.dll)
rundll32 [path] DLCItime.dll, _RunDLLEntry@16 DLCICATS
Resolves a timing problem where a Dell service tries to communicate with the printer but Windows is too busy - by either delaying the start of the service or restarting if the service failed to load. See here for more details on a similar Lexmark DLL entry (LXDCtime.dll)
rundll32 [path] DLCJtime.dll, _RunDLLEntry@16 DLCJCATS
Dell printer software - reports back on printer and cartridge useage
rundll32 [path] DLCQtime.dll, _RunDLLEntry@16 DLCQCATS
Resolves a timing problem where a Dell service tries to communicate with the printer but Windows is too busy - by either delaying the start of the service or restarting if the service failed to load. See here for more details on a similar Lexmark DLL entry (LXDCtime.dll)
rundll32 [path] DLCXtime.dll, _RunDLLEntry@16 DLCXCATS
rundll dnes.dll, DnDneCheckBindings DNE Binding Watchdog
Deterministic NDIS Extender (DNE). DNE is an NDIS-compliant module which appears to be a network device driver to all protocol stacks and a protocol driver to all network device drivers. Part of Gilat Communications internet satellite systems. Required if you have this system. Also installed by Winproxy - a proxy program for sharing internet connections through one computer. Required if you want it to work
rundll dnes.dll, DnDneCheckDUN13 DNE DUN Watchdog
Deterministic NDIS Extender (DNE). DNE is an NDIS-compliant module which appears to be a network device driver to all protocol stacks and a protocol driver to all network device drivers. Part of Gilat Communications internet satellite systems. Required if you have this system. Also installed by Winproxy - a proxy program for sharing internet connections through one computer. Required if you want it to work
rundll32.exe MSA64CHK.dll, DllMostrar DownloadLegalMusic
MatrixDialer related
rundll32.exe MSA64CHK.dll, DllMostrar DownloadMP3
MatrixDialer related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in the Winnt or Windows folder
rundll32.exe drkly16j.dll, ServiceCheck drkly16j
KidsWatch Time Control parental control software
rundll32 ..drvupd.inf drvupd
Hijacker - drvupd.inf file installs a "searchforge.com" hijack
rwwnw64d.exe DW_Start
Identified as a variant of the AdWare.Win32.ZenoSearch.am malware
Rcapi.exe ElsaCapiCtl
Assumed to stand for Remote Common Application Programming Interface (RCAPI), this was installed with an Elsa Microlink ISDN modem. If it is not there you can not bring up the dialog box which is sometimes needed to reset the modem
reg32.exe EReg
EReg is a software registration tool incorporated on products such as those by Brøderbund, Connectix, Hewlett-Packard, The Learning Company, and Sierra. Needless to say you don't need it
realmon.exe eTrust Realtime Monitor
Added by the LAZAR.B TROJAN!
Rundll32.exe [path] cdnspie.dll, ExecFilter ExFilter
CNNIC Update pest
RMSysTry.exe Extender Resource Monitor
Related to Windows Media Center from Microsoft
runfc.exe fc
Added by the CAMPURF WORM!
R3proxy.exe Fellowes Proxy
Installed with Fellowes EasyPoint mouse software. Not necessary for normal functioning of Fellowes mice but it is necessary to use the extended features of all Fellowes mice
rnd32.exe file laoder configuration
Added by the RBOT.BQJ WORM!
rundll32.exe QaBar.dll, ForceShowBar ForceShow
AdultLinks.QBar parasite related
rundll32.exe MSA64CHK.dll, DllMostrar FreeMP3download
MatrixDialer related
rundll32.exe [path] ftutil2.dll, SetWriteCacheMode ftutil2
Related to Promise Technology's FastTrak SX4030/4060 PCI ATA Raid 5 controller (and possibly others)
ra32.exe f~a
Added by the CAY TROJAN!
rundll32.exe [path] tbGame.dll, DllShowTB Games toolbar
Topconverting.com180Search "Games Toolbar" adware
realsched.exe gcasServ
Added by a variant of the TACTSLAY.A TROJAN! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name
regsvc32.exe Generic Service Process
Added by the GAOBOT.UJ or GAOBOT.UL WORMS!
regsvc32.exe Generic Services Process
Added by the GAOBOT.SY WORM!
rundll32.exe MSA64CHK.dll, DllMostrar GetMP3
MatrixDialer related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in the Winnt or Windows folder
rundll32.exe MSA64CHK.dll, DllMostrar GetTheMusic
MatrixDialer related
rundll32 [path] ctccw32.dll, findwnd gfxtray
Detected by Kaspersky as the AGENT.AOU TROJAN! See here. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted
readme.exe gouday.exe
Added by the BEAGLE.C WORM!
rundll32 gspndll.dll, postInstall final GsiFinal
USB DSL modem related - [what does it do and is it required in startup?
rundll32 ...gvagfxj.dll gvagfxj
Unidentified adware, spyware or virus
rundll32.exe [path] he3bbcff.dll, EnableRunDLL32 he3bbcff
LZIO.com adware downloader
rundll32.exe [path] he3e3fc4.dll, EnableRunDLL32 he3e3fc4
LZIO.com adware downloader
Remind32.exe Hewlett Packard Recorder
HP multifunction registration
rnxntup.exe hhtnsn
Added by a variant of the ORCU.B TROJAN!
raidman.exe HighPoint ATA RAID Management Software
HighPoint RAID management - hard disk striping/mirroring utility for increased performance and reliability. See here for more information on RAID
runlli32.exe HKEYok
Added by the QQPASS-U TROJAN!
remote.cmd hotdlll
Added by the BANKER-EHG TROJAN!
Remind32.exe HP-Aio Flight
HP multifunction registration
regsvr32.exe ....HREF.OCX HREF.OCX
HREF.OCX is an ActiveX control developed by xFX JumpStart and used to provide HTML-alike clickable links on Windows-based programs such as PopUpKiller
rundll32.exe [path] icdd7ee6.dll, EnableRunDLL32 icdd7ee6
LZIO.com adware downloader
rundll32.exe [path] icddefff.dll, EnableRunDLL32 icddefff
LZIO.com adware downloader
rundll32.exe Icsdclt.dll, ICSClient ICSDCLT
Internet Connection Sharing allows more than one computer to simultaneously access the internet with a single connection. Also required when networking two machines
rundll32.exe [path] tbextn.dll DllShowTB IE Menu Extension toolbar
Topconverting.com180Search "IEMenuExtension" toolbar
rundll32.exe [path] iel2cde8.dll, EnableRunDLL32 iel2cde8
LZIO.com adware downloader
rundll32.exe [path] ielcaabe.dll, EnableRunDLL32 ielcaabe
LZIO.com adware downloader
rundll32.exe [path] IKL.dll IKL
IKL surveillance software. Uninstall this software unless you put it there yourself
rundll32 image.dll, Install Image
CoolWebSearch parasite variant
rundll32.exe [path] ********.dll [* = random char] InfoData
Added by the VUNDO TROJAN!
rundll32.exe EGDHTML_1023.dll, InstantAccess Instant Access
Electronic_Group/InstantAccess premium rate adult content dialer variant
rundll32.exe eg_auth_****.dll, InstantAccess [**** = digits] Instant Access
Electronic_Group/InstantAccess premium rate adult content dialer variant
rundll32.exe EGCOMLIB_****.dll, InstantAccess [**** = digits] Instant Access
Electronic_Group/InstantAccess premium rate adult content dialer variant
rundll32.exe EGCOMSERVICE_****.dll, InstantAccess [**** = digits] Instant Access
Electronic_Group/InstantAccess premium rate adult content dialer variant
rundll32.exe EGDACCESS_****.dll, InstantAccess [**** = digits] Instant Access
Electronic_Group/InstantAccess premium rate adult content dialer variant
rundll32.exe p2esocks_****.dll, InstantAccess [**** = digits] Instant Access
Electronic_Group/InstantAccess premium rate adult content dialer variant
reminder.exe Instant Update Center
From Broderbund's PrintMaster 10. It is an event reminder (for calendar dates, etc). Delete from the startup using Startup Manager program because it keeps re-checking itself when using MSCONFIG. PrintMaster 11 uses filename PMremind.exe - it has to be unchecked in startup in the same manner
regedit.exe /s %windir%c:[month number] Internal
Added by the FORTNIGHT.D TROJAN!
recruit.exe Internet
Added by the RBOT-AJG WORM!
regsvr32.exe [path] Ir41_32.ax Ir41_32.ax
Intel(r) Indeo(r) video 4.4 Decompression Filter related
rundll32.exe iSecurity.cpl, SecurityMonitor iSecurity applet
Detected by Trend Micro as the DLOADER.UZO TROJAN! See here. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted
remote.cmd java
Added by the BANKER-EHG TROJAN!
runjava.exe Java Runtime Value
Added by the RBOT-DDJ WORM!
Reminder.exe Kana Reminder
Kana Reminder is a program which can be used to set a reminder to be triggered at a specified time
regsvr32 [path] kdp****.dll [* = random char] Kazaa Download Accelerator Updater (required)
SafeguardProtect/Veevo hijacker
rundll32.exe [path] apphelp.dll, ShimFlushCache KB926239
Microsoft KB926239 fix. Windows Media Player 10 may close unexpectedly on a Windows XP-based computer
rundll32 kctl32.dll, initialize kernctl32
Added by the AGENT.AT TROJAN!
Rlid.exe Key1
Added by the LIXY TROJAN!
rundll32 setupapi, InstallHinfSection... keymgr3.inf keymgrldr
CoolWebSearch Oemsyspnp parasite variant
rnnypbw.exe Kgjg
Added by the QuickLinks/Forethought adware
run32dll.exe klp
PAL PC Spy - key recorder and screen capture utility which controls and monitors everything that happens on your pc and online
razerhid.exe Krait
Razer Krait mouse driver
regsvr32.exe [path] kvern16.dll kvern16.dll
DailyWinner adware
rundll32.exe [path] kw3eef76.dll, EnableRunDLL32 kw3eef76
LZIO.com adware downloader
razerhid.exe Lachesis
Razer Lachesis mouse driver
RePEAtLD.exe LAsIAf32
Added by the REPEATLD WORM!
relaunch.exe Launcher
Audio Applications Launcher for the Philips Rythmic Edge soundcard (the Philips Rhythmic Edge is the same as the Thunderbird PCI soundcard - see TBtray). Available via Start -> Programs
rundll32.exe ..lhttseng.inf, RemoveCabinet lhttseng
Left over after installation of the British English version of the Lernout & Hauspie Text To Speech (TTS) Engine
rundll32.exe [path] li01f948.dll, EnableRunDLL32 li01f948
LZIO.com adware downloader
runservice.exe LicCrtl
Part of the eLicense Copy Protection scheme employed by some software and games. When this service is not running, the eLicense wrapper is unable to extract and execute the program
rundll32.exe [path] MMFS.DLL, Service LicCtrl
Part of the eLicense Copy Protection scheme employed by some software and games. When this service is not running, the eLicense wrapper is unable to extract and execute the program
Rubicon.exe LIU
Logitech Internet Update. Used to update drivers/software for Logitech's Wingman, QuickCam, etc devices. Reports claim it doesn't work very well and you can manually update the files anyway
rundll32.exe Ljx
Added by the LINEAG-ABD TROJAN! Note - this is not the legitimate rundll32.exe process, which is found in the Windows folder (98ME) or the System32 folder(NT2000XP). This file is located in the "inf" sub-folder
rundll.exe setupx.dll, InstallHinfSection ..LLMODCL2.INF LLMODCL2
??
rundll32.exe load
Added by the WOWCRAFT TROJAN!
rundl132.exe load
Added by the LOOKED-CK WORM!
rundll32.exe mshtmpre.dll, MShtmpre LoadHTML
Mshtmpre adware
rundll32.exe loadMecq3
Added by the LEGMIR-AS TROJAN!
rundll32.exe loadMefs
Added by the LEGMIR-JB TROJAN! Note - this is not the legitimate rundll32.exe process, which is found in the Windows folder (98ME) or the System32 folder(NT2000XP). This file is located in the Windowsinf or Winntinf folder
Rundll32.exe powrprof.dll LoadPowerProfile
Power management specifics such as monitor shut-off, system standby, etc. Associated with power management and is listed twice - see here. Loads your selected power scheme. May not be required - depends upon whether you modify the default Control Panel -> Power Options settings
Rundll.exe powerprof.dll LoadPowerProfile
Added by the LOXOSCAM TROJAN! Note - do not confuse with the valid LoadPowerProfile entry! Notice that the infected version uses "Rundll.exe" whereas the uninfected version uses "Rundll32.exe"
rundl.exe LoadPowerProfile
Added by the TOFAZZOL TROJAN! Not to be confused with the valid LoadPowerProfile entry where the command is Rundll32.exe powrprof.dll
Rundll32.exe LoadPowerProfile
Added by the MIROOT WORM! Note - do not confuse with the valid LoadPowerProfile entry which has "powrprof.dll" appended to the command/data line
rundll32.exe powerprof.dll CheckPowerProfile LoadPowerScheme
Ulubione adult content dialer
Rest In Peace LoadService
Added by the KANGAROO-A WORM!
rundll32.exe [path] SIPSPI32.dll, SIPSPI32 LoadSIPS
123Mania adware
ragui.exe LogMeIn GUI
RemotelyAnywhere is a remote administration and remote control solution for Windows. It allows access to the host computer via the network (the LAN, an intranet or the Internet) - and on the client side all you need is a web browser, a terminal emulator or a WAP-enabled phone
RundlI.exe LTM2
Added by the MULTIDRP.BG TROJAN!
rundll32.exe LTT2
Added by the LINEAGE-BI TROJAN!
rundll32 [path] LXBStime.dll, _RunDLLEntry@16 LXBSCATS
Lexmark printer software - reports back on printer and cartridge useage
rundll32 [path] LXBTtime.dll, _RunDLLEntry@16 LXBTCATS
Lexmark printer software - reports back on printer and cartridge useage
rundll32 [path] LXBUtime.dll, _RunDLLEntry@16 LXBUCATS
Lexmark printer software - reports back on printer and cartridge useage
rundll32 [path] LXBXtime.dll, _RunDLLEntry@16 LXBXCATS
Lexmark printer software - reports back on printer and cartridge useage
rundll32 [path] LXBYtime.dll, _RunDLLEntry@16 LXBYCATS
Resolves a timing problem where the Lexmark Communications service tries to communicate with the printer but Windows is too busy - by either delaying the start of the service or restarting if the service failed to load. See here for more details on a similar Lexmark DLL entry (LXDCtime.dll)
rundll32 [path] LXCCtime.dll, _RunDLLEntry@16 LXCCCATS
Lexmark printer software - reports back on printer and cartridge useage
rundll32 [path] LXCEtime.dll, _RunDLLEntry@16 LXCECATS
Resolves a timing problem where the Lexmark Communications service tries to communicate with the printer but Windows is too busy - by either delaying the start of the service or restarting if the service failed to load. See here for more details on a similar Lexmark DLL entry (LXDCtime.dll)
rundll32 [path] LXCFtime.dll, _RunDLLEntry@16 LXCFCATS
Resolves a timing problem where the Lexmark Communications service tries to communicate with the printer but Windows is too busy - by either delaying the start of the service or restarting if the service failed to load. See here for more details on a similar Lexmark DLL entry (LXDCtime.dll)
rundll32 [path] LXCGtime.dll, _RunDLLEntry@16 LXCGCATS
Lexmark printing software - reports back on printer and cartridge useage
rundll32 [path] LXCJtime.dll, _RunDLLEntry@16 LXCJCATS
Resolves a timing problem where the Lexmark Communications service tries to communicate with the printer but Windows is too busy - by either delaying the start of the service or restarting if the service failed to load. See here for more details on a similar Lexmark DLL entry (LXDCtime.dll)
rundll32 [path] LXCQtime.dll, _RunDLLEntry@16 LXCQCATS
Lexmark printer software - reports back on printer and cartridge useage
rundll32 [path] LXCRtime.dll, _RunDLLEntry@16 LXCRCATS
Lexmark printer software - reports back on printer and cartridge useage
rundll32 [path] LXCTtime.dll, _RunDLLEntry@16 LXCTCATS
Lexmark printer software - reports back on printer and cartridge useage
rundll32 [path] LXCYtime.dll, _RunDLLEntry@16 LXCYCATS
Resolves a timing problem where the Lexmark Communications service tries to communicate with the printer but Windows is too busy - by either delaying the start of the service or restarting if the service failed to load. See here for more details on a similar Lexmark DLL entry (LXDCtime.dll)
rundll32 [path] LXDCtime.dll, _RunDLLEntry@16 LXDCCATS
Resolves a timing problem where the Lexmark Communications service tries to communicate with the printer but Windows is too busy - by either delaying the start of the service or restarting if the service failed to load. See here for more details on a similar Lexmark DLL entry (LXDCtime.dll)
rundll32 [path] LXDItime.dll, _RunDLLEntry@16 LXDICATS
Lexmark printer software - reports back on printer and cartridge useage
rarww.exe Macromedia Critical Updater
Added by a variant of the RBOT WORM!
RESWIN.EXE Mania Win Restore
Pinball Mania for Windows from 21st Century Entertainment LTD (1995). Runs briefly at start-up then terminates. Available via Start -> Programs
rundll32.exe MSDServ.dll, check registry Mass storage check registry
Used with a USB based smartmedia card reader
Rundll32 CTMBHA.DLL, MBMon MBMon
Creative Filter AudioControlMB Module - related to the Creative Audigy line of sound cards. What does it do and is it required?
RuLaunch.exe McAfee.InstantUpdate.Monitor
Instant Updater for McAfee's VirusScan, Internet Security, Quick Clean, Uninstaller and Firewall products. In the case of VirusScan leave it enabled unless you update manually on a regular basis
runonce.exe mdac_runonce
Associated with MS Data Access Components (MDAC). Sometimes left over after installation - not required. NOTE :- don't delete "runonce.exe".
Root.exe MediaPath
Added by the GRUEL WORM!
reloc32.exe Memory relocation service
Added by the RELFEERWORM!
runservice.exe Micosoft Data Core
Added by the IRCBOT.BK WORM!
radnom.exe Microsoft
Added by the RBOT-GHO WORM!
rtvcscan.exe Microsoft
Added by the RBOT-GGU WORM!
rundll.exe Microsoft
Added by the RBOT-GSJ WORM!
rundll32.exe Microsoft (R) Windows DLL Loader
Added by the RANKY.W TROJAN! Note - this is not the legitimate rundll32.exe process, which is found in the Windows folder (98ME) or the System32 folder(NT2000XP). This file is located in a "dll" subfolder of the Winnt or Windows folder
rasmngr.exe Microsoft DirectX
Added by a variant of the RBOT WORM!
runapidll.exe Microsoft Dll
Added by the RBOT-GRG WORM!
rundll64 Microsoft Install Shield Services
Added by the RBOT-FSH WORM!
Rhost32.exe Microsoft IT Update
Added by a variant of the IRC.BOT TROJAN!
regedit.exe Microsoft Regestry Edit Manager
Detected by Trend Micro as the SHEUR.HC WORM! See here
regedit32.exe Microsoft Regestry Manager
Added by a variant of the IRCBOT.ARD WORM!
registry32.exe Microsoft Regestry Manager
Added by the IRCBOT.ARD WORM!
router.exe Microsoft Router Manager
Added by a variant of the IRCBOT TROJAN!
rserv.exe Microsoft Server
Added by the AGOBOT.AVS WORM!
rundll.exe Microsoft Service
Added by the POPO-A WORM! Note - this is NOT the Windows system file of the same name as described here
reg32.exe Microsoft System Firewall 2006.2
Added by a variant of the SDBOT WORM!
rxxhost.exe Microsoft Update DLL
Added by a variant of the RBOT WORM!
rxhost.exe Microsoft Update Machine
Added by the RBOT.FC WORM!
rxxhost.exe Microsoft Update Machine
Added by the RBOT.EP WORM!
rundll24.exe Microsoft Update Module
Added by the RBOT-PS WORM!
rpcxWindows.exe Microsoft Windows Secure Server
Added by the RBOT-LL WORM!
rpcxwinupdt.exe Microsoft Windows Secure Update
Added by an unidentified WORM or TROJAN!
rundlls.exe Microsoft Windows Update
Added by the HABRACK WORM!
rhost32.exe Microsoft Windows Update
Added by a variant of the IRCBOT TROJAN!
RunDLL32.exe ehuihlp.dll, BootMediaCenter Microsoft(r) Windows(r) Operating System
Starts Windows Media Center every time Windows Vista (Home Premium or Ultimate) boots. Disable by unchecking the "Start Windows Media Center when Windows Starts" option via Windows Media Center -> Tasks -> Settings -> General -> Startup and Window Behaviour
rundll32.exe oobefldr.dll, ShowWelcomeCenter Microsoft(r) Windows(r) Operating System
Shows the Welcome Center every time you boot into Windows Vista
rune.pif Microsoftf DDEs ContDLL
Added by the RBOT-AGF WORM!
runm.pif Microsoftf DDEs ContrDL
Added by the RBOT-AFQ WORM!
read.pif Microsoftz turn Control
Added by the RBOT-AFS WORM!
rundll32.exe migrate.dll, CallVendorSetupDlls MigrationVendorSetupCaller
??
rundllc32b.exe Mircrosoft Windows Config DLL
Added by the RBOT-ZY WORM!
recover.exe mmsys
??
RunDll32 MMSystem
Added by the FUNNER-A WORM!
readernotify.exe Mobipocket Reader Notifications
Part of Mobipocket Reader - "Store all your eBooks, eNews & self-published eDocs on your PC. Download eBooks in Mobi format from your favorite ebookstores to read on your smartphone, PDA, laptop or on your desktop PC"
RUNDLL32.EXE reg.dll, ondll_reg Module Call initialize
Added by a variant of the LOVGATE WORM!
rundll32.exe MSA64CHK.dll, DllMostrar MoreContent
MatrixDialer related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA64CHK.dll" file is located in the Winnt or Windows folder
rundll32.exe MSA64CHK.dll, DllMostrar MP3Collection
MatrixDialer related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "MSA6